Server crashes on invalid Cloud Function or Cloud Job name

NGHIÊM TRỌNG 9.0CVE-2024-29027 · BIT-parse-2024-29027 · GHSA-6hh7-46r2-vf29 · Công bố 19/03/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-29027 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.0) ảnh hưởng parse-server (parseplatform), parse-server.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.2%, cao hơn 67.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.5.5, 7.0.0-alpha.29 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
parse-server parseplatform	`= 7.0.0< 6.5.5`	`6.5.5`
parse-server npm	`≥ 7.0.0-alpha.1, < 7.0.0-alpha.29< 6.5.5`	`7.0.0-alpha.296.5.5`

Mô tả

Impact

Calling an invalid Parse Server Cloud Function name or Cloud Job name crashes server and may allow for code injection.

Patches

Added string sanitation for Cloud Function name and Cloud Job name.

Workarounds

Sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29
https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 (Fix for Parse Server 7 alpha)
https://github.com/parse-community/parse-server/releases/tag/6.5.5 (Fix for Parse Server 6 LTS)

Mô tả của NVD

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.